superorbital / policy-probe

A tool for testing network policy
0 stars 0 forks source link

Specifying multiple probes in a single test case #4

Open benmoss opened 1 year ago

benmoss commented 1 year ago

In the current config each test case runs a single probe which tests a single from->to relationship. @rsalmond and I were chatting about how we might able to express multiple tos from a single from.

We thought maybe something like this:

apiVersion: networking.superorbital.io/v1beta1
kind: TestSuite
metadata:
  name: namespaces
spec:
  testCases:
    - from:
        deployment:
          name: web
          namespace: a
      to:
        - tcp:
            host: api.staging
            port: 80
            failureThreshold: 5
            expect: Pass
        - httpGet:
            host: api.staging
            port: 80
            path: /healthz
            httpHeaders:
              - name: User-Agent
                value: probe
            expect: Pass
        - tcp:
            host: api.prod
            port: 80
            expect: Fail

where a from has many to (replacing the single to). There's a lot of ways to shave this cat, we came across this project that basically is trying to achieve the same thing with a very different config style.

rsalmond commented 1 year ago

For the purposes of allowing a compact representation of multiple test cases from a single vantage point I like this model. While discussing this additional expressiveness and looking at the project linked above @benmoss pointed out that the model it uses permits many degrees of freedom, probably more than we need.

edit: convo about allowed/denied moved to #5

benmoss commented 1 year ago

These are separate issues, but it's my mistake for including the allowed/denied change here. I've updated the original post to disentangle the whole "protocol semantics" problem from the multiple probes problem